Names with an apostrophe break the XPath queries in RtLocks, RtCounters, and RtCounter
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
Research direction
Start in src/main/java/co/stateful/RtLocks.java, RtCounter.java, and RtCounters.java, where the issue shows the three XPath expressions that interpolate names. Read how those methods build and execute their queries, then use one safe XPath literal approach consistently in all three locations. Done when names containing either or both quote types work for the listed operations without changing which item is selected.
Written by the indexing model from the issue text.
Description
A lock or counter name that contains a single quote makes the XPath expression invalid, so the call fails instead of finding the item.
The name is pasted straight into a single-quoted XPath literal:
// src/main/java/co/stateful/RtLocks.java:53
.nodes(String.format("/page/locks/lock[name='%s']", name))
// src/main/java/co/stateful/RtCounter.java:93
"/page/counters/counter[name='%s']/links/link[@rel='%s']/@href"
// src/main/java/co/stateful/RtCounters.java (delete)
"/page/counters/counter[name='%s']/links/link[@rel='delete']/@href"
Take locks.exists("it's"): the expression becomes /page/locks/lock[name='it's'], which is malformed XPath, so exists throws instead of returning a boolean. The same happens in counter.set(...), counter.incrementAndGet(...), and counters.delete("it's"). A name like x' or '1'='1 changes the query and may select another item.
Fix: build the XPath literal safely. Either pass the name as an XPath variable, or write a small helper that wraps the value in double quotes when it has a single quote, and uses concat(...) when it has both kinds of quotes. Use it in all three places.
- Dominant language
- Java
- Stars
- 10
- Forks
- 3
- Avg merge
- 4h 33m
- Merged PRs (30d)
- 7
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sttc/java-sdk
-
MkCounter.name() returns the class name instead of the counter name, and MkCounters drops the namePossibly taken @yegor256 claimed this 6 days ago. Openbug
-
Dependency DashboardOpenwontfix
Difficulty 1/5 Under an hour Newbie friendliness 35/100
Similar issues
-
desktop edt not responding
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
physical
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
antonyrag/ragleap-core#1339 ·
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
rezelyn/Wathe-Extended#116 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
langchain4j/langchain4j#7068 ·
Maintainers usually reply within 1 day